refactor: session-based external auth, dynamic sources, drop netease UID

Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
  old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients

Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
  (register, dashboard identity, users admin, bans), labels dynamic

UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
  dropped, frontend fields optional)

Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)

public/js/pages/dashboard.js

@@ -18,6 +18,14 @@ const Dashboard = {
       const bans = Auth.isAdmin() ? await API.get('/bans/active').catch(()=>[]) : [];
       const identities = await API.get('/auth/identities').catch(()=>[]);
       this.renderContent(ct, stats, exports, bans, identities);
+      // 渲染完成后将来源 code 替换为动态标签
+      U.sources().then(() => {
+        ct.querySelectorAll('[data-src]').forEach(el => {
+          const code = el.dataset.src;
+          const hit = (U._sourcesCache||[]).find(s => s.code === code);
+          el.textContent = hit ? hit.label : (code || '-');
+        });
+      }).catch(()=>{});
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }
   },
 
@@ -42,12 +50,12 @@ const Dashboard = {
       <div class="card"><div class="card-h"><i class="fas fa-id-card"></i> 我的身份 ${idents.length < 2 ? `<button class="btn btn-p btn-sm" onclick="Dashboard.showAddIdentity()">绑定${idents.length === 1 ? '另一来源' : '身份'}</button>` : ''}</div>
         <div class="card-b">
           ${idents.length === 0 ? '<span class="tm">暂无身份，点击右上角绑定</span>' : `<table><thead><tr><th>来源</th><th>游戏名</th><th>UID</th><th>绑定时间</th><th>操作</th></tr></thead><tbody>${idents.map(it=>`<tr>
-            <td><span class="badge bg-${it.source==='netease'?'processing':'admin'}">${it.source==='netease'?'网易端':'皮肤站'}</span></td>
+            <td><span class="badge bg-admin" data-src="${U.esc(it.source)}">${U.esc(it.source||'-')}</span></td>
             <td>${U.esc(it.game_name)}</td><td class="ts">${U.esc(it.game_uid||'-')}</td>
             <td class="ts">${U.date(it.created_at)}</td>
             <td>${idents.length > 1 ? `<button class="btn btn-d btn-sm" onclick="Dashboard.removeIdentity(${it.id})"><i class="fas fa-unlink"></i> 解绑</button>` : '<span class="tm ts">主身份</span>'}</td>
           </tr>`).join('')}</tbody></table>`}
-          <p class="tm ts mt-4"><i class="fas fa-info-circle"></i> 同一账号可同时绑定网易端与皮肤站身份，提交工单时选择使用哪个身份。</p>
+          <p class="tm ts mt-4"><i class="fas fa-info-circle"></i> 同一账号可绑定多个来源身份，提交工单时选择使用哪个身份。</p>
         </div>
       </div>
 
@@ -71,12 +79,16 @@ const Dashboard = {
     U.modal('添加封禁', `
       <form id="ban-form">
         <div class="grid-2"><div class="form-group"><label>玩家名 *</label><input id="ban-name" required></div><div class="form-group"><label>UID</label><input id="ban-uid"></div></div>
-        <div class="grid-2"><div class="form-group"><label>来源</label><select id="ban-source"><option value="">未知</option><option value="netease">网易端</option><option value="skin">皮肤站</option></select></div><div class="form-group"><label>类型</label><select id="ban-type" onchange="Dashboard.checkMinDuration()"><option value="ban">封禁</option><option value="mute">禁言</option><option value="warn">警告</option></select></div></div>
+        <div class="grid-2"><div class="form-group"><label>来源</label><select id="ban-source"><option value="">未知</option></select></div><div class="form-group"><label>类型</label><select id="ban-type" onchange="Dashboard.checkMinDuration()"><option value="ban">封禁</option><option value="mute">禁言</option><option value="warn">警告</option></select></div></div>
         <div class="grid-2"><div class="form-group"><label>时长</label><select id="ban-dur"><option value="">永久</option><option value="3天">3天</option><option value="7天">7天</option><option value="30天">30天</option></select></div></div>
         <div class="form-group"><label>原因</label><textarea id="ban-reason" rows="2"></textarea></div>
         <div class="modal-f"><button type="button" class="btn btn-o" data-action="App:closeModal">取消</button><button type="submit" class="btn btn-p">添加</button></div>
       </form>
     `);
+    U.sources().then(list => {
+      const sel = document.getElementById('ban-source');
+      if (sel) sel.innerHTML = '<option value="">未知</option>' + list.map(s => `<option value="${U.esc(s.code)}">${U.esc(s.label)}</option>`).join('');
+    }).catch(()=>{});
     document.getElementById('ban-form').onsubmit = async e => {
       e.preventDefault();
       try {
@@ -90,9 +102,9 @@ const Dashboard = {
   showAddIdentity() {
     U.modal('绑定身份', `
       <form id="ident-form">
-        <div class="form-group"><label>来源</label><select id="ident-source"><option value="netease">网易端</option><option value="skin">皮肤站</option></select></div>
+        <div class="form-group"><label>来源</label><select id="ident-source"><option value="">加载中...</option></select></div>
         <div class="form-group"><label>游戏名 *</label><input id="ident-name" required placeholder="Minecraft ID"></div>
-        <div class="form-group" id="ident-uid-group"><label>网易UID</label><input id="ident-uid" placeholder="仅网易端必填"></div>
+        <div class="form-group" id="ident-uid-group" style="display:none"><label>UID(可选)</label><input id="ident-uid" placeholder="选填"></div>
         <div class="form-group hidden" id="ident-skin-group">
           <label>皮肤站地址</label>
           <div style="display:flex;gap:6px">
@@ -105,14 +117,21 @@ const Dashboard = {
         <div class="modal-f"><button type="button" class="btn btn-o" onclick="App.closeModal()">取消</button><button type="submit" class="btn btn-p">绑定</button></div>
       </form>
     `);
+    // 动态加载来源
+    U.sources().then(async list => {
+      const sel = document.getElementById('ident-source');
+      sel.innerHTML = list.length
+        ? list.map(s => `<option value="${U.esc(s.code)}">${U.esc(s.label)}</option>`).join('')
+        : '<option value="">不指定</option>';
+      toggleSource();
+    }).catch(()=>{});
     const toggleSource = () => {
-      const isNetease = document.getElementById('ident-source').value === 'netease';
-      document.getElementById('ident-uid-group').style.display = isNetease ? '' : 'none';
-      document.getElementById('ident-uid').required = isNetease;
-      document.getElementById('ident-skin-group').classList.toggle('hidden', isNetease);
+      const src = document.getElementById('ident-source').value;
+      const isSkin = src === 'skin';
+      document.getElementById('ident-uid-group').style.display = isSkin ? 'none' : '';
+      document.getElementById('ident-skin-group').classList.toggle('hidden', !isSkin);
     };
     document.getElementById('ident-source').onchange = toggleSource;
-    toggleSource();
     // 自动带出站点配置的皮肤站地址
     API.get('/settings/skin-site').then(r => {
       if (r.site && !document.getElementById('ident-site').value) document.getElementById('ident-site').value = r.site;